That's exactly what I was looking for. My program is crashing in free (the debugger shows free calling HeapFree when it crashes). The boundary tags appear to be intact, and unfortunately turning on heap checking on ever free did not find the
problem immediately, so I have a bit more work to do, but this gets me closer.